Centralise lockdown author checks

[kerobbi]

Summary

Extracts a single shared helper for lockdown mode author checks and routes GetIssue and GetPullRequest through it, failing closed when the author can't be verified.

Why

Part of https://github.com/github/copilot-mcp-core/issues/1798

What changed

• Added authorLockdownResult (pkg/github/lockdown.go) - one place that resolves the lockdown decision for content authored by a given login, with shared restriction messages - and routed GetIssue and GetPullRequest through it.
• Fail closed when the author login is empty (previously an empty login skipped the check); normalised GetPullRequest's error path to a tool-result error to match GetIssue.
• Added unit tests for the helper and a lockdown test for GetPullRequest.

MCP impact

• Tool schema or behavior changed - no schema change; behaviour differs only under lockdown mode (empty-author content is now withheld, matching the existing per-item filters).

Prompts tested (tool changes only)

• "Get issue X from Y" with lockdown mode enabled/disabled
• "Get PR X from Y" with lockdown mode enabled/disabled

Security / limits

• Data exposure, filtering, or token/size limits considered - consolidates the lockdown content filtering decision; no change outside this.

Tool renaming

• I am not renaming tools as part of this PR

Lint & tests

• Linted locally with ./script/lint
• Tested locally with ./script/test

Docs

• Not needed

[Copilot]

Pull request overview

Centralizes lockdown author verification for issue and pull-request reads, failing closed when authors cannot be verified.

Changes:

• Added a shared lockdown decision helper and restriction messages.
• Routed issue and pull-request retrieval through the helper.
• Added helper and pull-request lockdown tests.

Show a summary per file

File	Description
pkg/github/lockdown.go	Adds shared author lockdown logic.
pkg/github/lockdown_test.go	Tests missing-cache and empty-author handling.
pkg/github/issues.go	Uses the shared helper for issue reads.
pkg/github/pullrequests.go	Uses the shared helper for pull-request reads.
pkg/github/pullrequests_test.go	Adds lockdown allow/deny cases.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Medium